CVE-2024-8974

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-8974", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2024-09-18T14:01:58.766Z", "datePublished": "2024-09-26T23:02:00.153Z", "dateUpdated": "2024-09-27T15:46:48.041Z"}, "containers": {"cna": {"title": "Incorrect Provision of Specified Functionality in GitLab", "descriptions": [{"lang": "en", "value": "Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions it was possible to disclose to an unauthorised user the path of a private project.\""}], "affected": [{"vendor": "GitLab", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "versions": [{"version": "15.6", "status": "affected", "lessThan": "17.2.8", "versionType": "semver"}, {"version": "17.3", "status": "affected", "lessThan": "17.3.4", "versionType": "semver"}, {"version": "17.4", "status": "affected", "lessThan": "17.4.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-684: Incorrect Provision of Specified Functionality", "cweId": "CWE-684", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/482843", "name": "GitLab Issue #482843", "tags": ["issue-tracking", "permissions-required"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 2.6, "baseSeverity": "LOW"}}], "solutions": [{"lang": "en", "value": "Upgrade to version 17.4.1, 17.3.4, 17.2.8."}], "credits": [{"lang": "en", "value": "This vulnerability has been discovered internally by GitLab team member [Lukas Eipert](https://gitlab.com/leipert)", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2024-09-26T23:02:00.153Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-27T15:46:36.689310Z", "id": "CVE-2024-8974", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-27T15:46:48.041Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-8974", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-27T15:46:36.689310Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-27T15:46:42.955Z"}}], "cna": {"title": "Incorrect Provision of Specified Functionality in GitLab", "credits": [{"lang": "en", "type": "finder", "value": "This vulnerability has been discovered internally by GitLab team member [Lukas Eipert](https://gitlab.com/leipert)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.6, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "product": "GitLab", "versions": [{"status": "affected", "version": "15.6", "lessThan": "17.2.8", "versionType": "semver"}, {"status": "affected", "version": "17.3", "lessThan": "17.3.4", "versionType": "semver"}, {"status": "affected", "version": "17.4", "lessThan": "17.4.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to version 17.4.1, 17.3.4, 17.2.8."}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/482843", "name": "GitLab Issue #482843", "tags": ["issue-tracking", "permissions-required"]}], "descriptions": [{"lang": "en", "value": "Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions it was possible to disclose to an unauthorised user the path of a private project.\""}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-684", "description": "CWE-684: Incorrect Provision of Specified Functionality"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2024-09-26T23:02:00.153Z"}}}, "cveMetadata": {"cveId": "CVE-2024-8974", "state": "PUBLISHED", "dateUpdated": "2024-09-27T15:46:48.041Z", "dateReserved": "2024-09-18T14:01:58.766Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2024-09-26T23:02:00.153Z", "assignerShortName": "GitLab"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [{"lessThan": "17.2.8", "status": "affected", "version": "15.6", "versionType": "semver"}, {"lessThan": "17.3.4", "status": "affected", "version": "17.3", "versionType": "semver"}, {"lessThan": "17.4.1", "status": "affected", "version": "17.4", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "CF1537ED-2DE1-4781-ABD4-64816E5CE8D4", "versionEndExcluding": "17.2.8", "versionStartIncluding": "15.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "84ADBC3D-7A98-453A-8F34-FF810842EDCA", "versionEndExcluding": "17.2.8", "versionStartIncluding": "15.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "FBB47BC0-FE38-4628-B4C2-DA89EC467CF8", "versionEndExcluding": "17.3.4", "versionStartIncluding": "17.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "27CB6247-D7EE-40BB-BF4A-8CE5350E31BF", "versionEndExcluding": "17.3.4", "versionStartIncluding": "17.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:17.4.0:*:*:*:community:*:*:*", "matchCriteriaId": "4FEBC1F7-0AAA-4CA2-B099-3F4218900FB3", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:17.4.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "3AC3130C-A3AA-403A-85D9-92FD2B8BC091", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions it was possible to disclose to an unauthorised user the path of a private project.\""}, {"lang": "es", "value": "Divulgaci\u00f3n de informaci\u00f3n en Gitlab EE/CE que afecta a todas las versiones desde la 15.6 anterior a la 17.2.8, la 17.3 anterior a la 17.3.4 y la 17.4 anterior a la 17.4.1: en condiciones espec\u00edficas era posible revelar a un usuario no autorizado la ruta de un proyecto privado."}], "id": "CVE-2024-8974", "lastModified": "2026-06-17T08:23:39.717", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.6, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "cve@gitlab.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-8974", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-27T15:46:36.689310Z", "version": "2.0.3"}}]}, "published": "2024-09-26T23:15:03.083", "references": [{"source": "cve@gitlab.com", "tags": ["Broken Link"], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/482843"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-684"}], "source": "cve@gitlab.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-863"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}